Detecting malicious resources in a network based upon active client reputation monitoring

ABSTRACT

Systems and methods for detecting malicious resources by analyzing communication between multiple resources coupled to a network are provided. According to one embodiment, a method is performed for client reputation monitoring. A monitoring unit within a network observes activities relating to multiple monitored devices within the network. For each observed activity, the monitoring unit assigns a score to the observed activity based upon a policy of multiple polices established within the monitoring unit. For each of the monitored devices, the monitoring unit maintains a current reputation score for the monitored device based upon the score and a historical score associated with the monitored device. The monitoring unit classifies one of the monitored devices as potentially being a malicious resource based upon its current reputation score.

COPYRIGHT NOTICE

Contained herein is material that is subject to copyright protection.The copyright owner has no objection to the facsimile reproduction ofthe patent disclosure by any person as it appears in the Patent andTrademark Office patent files or records, but otherwise reserves allrights to the copyright whatsoever. Copyright © 2012, Fortinet, Inc.

BACKGROUND

Field

Embodiments of the present invention generally relate to detection ofmalicious resources. In particular, embodiments of the present inventionrelate to active unified threat management (UTM) profiling andmonitoring of client reputation scores by analyzing communicationbetween a plurality of resources coupled to the network.

Description of the Related Art

In a network, such as a computing network or a telecommunicationnetwork, coupled to resources, such as, computers, laptops, mobiles,Personal Digital Assistants (PDAs), virtual server, virtual machines,widgets, and the like, the resources are susceptible to hostile attacksarising as a result of malicious objects such as malware, web robots orBOTS, phishing, modified virus codes, and other viruses. The maliciousobjects may contaminate resources and initiate risky activities in thenetwork, such as, bad connection attempts, file sharing applications,session initiation for incoming connections, and so forth. Therefore, aresource contaminated with one or more malicious objects may beconsidered as a malicious resource for the network.

Such malicious resources may further contaminate other resources in thenetwork. Hence, detection of the malicious resources is essential forsecurity and efficient performance of the resources coupled to thenetwork.

A known technique to detect potential malicious resources involvesidentification of a signature or a representative code pattern within afile or process on the resource being scanned. In this technique, asignature of a file or process at issue is compared with a list ofsignatures corresponding to malicious objects. If the signature beingchecked is present in the list of signatures, the resource is or has thepotential of becoming a malicious resource. In this technique, the listof signatures must be frequently updated otherwise a lag period betweennew threats and anticipated signatures may develop. Moreover, thistechnique is less effective for modified virus codes and targetedattacks like spear phishing.

Another existing technique involves scanning for potential intrusionsbased on behavior of the resources (e.g., requests involving filesharing or any acts of communication to or from the resources). Suchscanning involves dynamic monitoring of internal and externalfunctioning of the resources receiving/sending the requests, andaccordingly observing the behavior of the resources. This techniqueinvolves heavy processing and like pattern matching can produce falsepositives and can miss newly developed threats.

In view of the foregoing, there exists a need for new and more effectivetechniques for detection of malicious resources in the network.

SUMMARY

Systems and methods are described for detecting malicious resources byanalyzing communication between multiple resources coupled to a network.According to one embodiment, a method of client reputation monitoring isprovided. A monitoring unit within a network observes activitiesrelating to multiple monitored devices within the network. For eachobserved activity, the monitoring unit assigns a score to the observedactivity based upon a policy of multiple polices established within themonitoring unit. For each of the monitored devices, the monitoring unitmaintains a current reputation score for the monitored device based uponthe score and a historical score associated with the monitored device.The monitoring unit classifies one of the monitored devices aspotentially being a malicious resource based upon its current reputationscore.

According to one embodiment, a resource communicates with anotherresource by exchanging requests over the network. A monitoring unitanalyzes these requests based on one or more policies associated withmalware activities. The monitoring unit associates a score to a resourceduring exchange of a request. The score is based on compliance of theresource with the one or more policies.

This score may be consolidated with similar past scores of the resource.The consolidated score of the resource is utilized to identifyreputation of the resource. Thereafter, the reputation may be utilizedby a user to identify whether the resource includes any malicious objectand thereby identify whether the resource is a malicious resource ornot.

In an exemplary embodiment, a gateway device may be utilized as amonitoring unit. In this scenario, the gateway device is capable ofdetecting and monitoring all the requests coming from or going to anexternal network, such as over Internet to resources in an internalnetwork, such as a Local Area Network (LAN).

Various embodiments of the invention may be enabled by using a graphicaluser interface (GUI). The GUI includes menus and sub-menus for providingaccess to the monitoring unit. The menus and sub-menus includeinformation corresponding to policies for malware activities. Further,the menus and sub-menus provide access to scores associated with thepolicies. The GUI facilitates display of reputation of the resourcescoupled to the network in form of bar charts and tables which may beviewed by a user. In addition, the GUI may enable a user to customizethe policies and the scores for generating reputation.

BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments of the present disclosure are illustrated by way ofexamples, and not by the way of any limitation, in the figures of theaccompanying drawings and in which like reference numerals refer tosimilar elements and in which:

FIG. 1 is a block diagram conceptually illustrating an exemplaryenvironment in which various embodiments of the present invention may beemployed.

FIG. 2 is an exemplary system diagram in accordance with an embodimentof the present invention.

FIG. 3 is another exemplary environment in which various embodiments ofthe present invention may be employed.

FIG. 4 is an exemplary computer system with which embodiments of thepresent disclosure may be utilized.

FIG. 5 is a flow diagram illustrating a method for detection ofmalicious resources in accordance with an embodiment of the presentinvention.

FIG. 6 is a flow diagram illustrating a method for customizing policiesand reputation by a user in accordance with an embodiment of the presentinvention.

FIGS. 7A-7E illustrate exemplary graphical user interface pages tosupport detection of the malicious resources in accordance with anembodiment of the present invention.

FIGS. 8A-8B illustrate exemplary graphical user interface pages tosupport an alternative configuration method in accordance with anembodiment of the present invention.

DETAILED DESCRIPTION

Systems and methods for detecting malicious resources by analyzingcommunications between multiple resources in a network are described.

In the following description, numerous specific details are set forth inorder to provide a thorough understanding of embodiments of the presentdisclosure. It will be apparent, however, to one skilled in the art thatembodiments of the present disclosure may be practiced without some ofthese specific details. In other instances, well-known structures anddevices are shown in block diagram form.

Embodiments of the present disclosure include various steps, which willbe described below. The steps may be performed by hardware components ormay be embodied in machine-executable instructions, which may be used tocause a general-purpose or special-purpose processor programmed with theinstructions to perform the steps.

Alternatively, the steps may be performed by a combination of hardware,software, firmware and/or by human operators.

Embodiments of the present disclosure may be provided as a computerprogram product, which may include a machine-readable storage mediumtangibly embodying thereon instructions, which may be used to program acomputer (or other electronic devices) to perform a process. Themachine-readable medium may include, but is not limited to, fixed (hard)drives, magnetic tape, floppy diskettes, optical disks, compact discread-only memories (CD-ROMs), and magneto-optical disks, semiconductormemories, such as ROMs, PROMs, random access memories (RAMs),programmable read-only memories (PROMs), erasable PROMs (EPROMs),electrically erasable PROMs (EEPROMs), flash memory, magnetic or opticalcards, or other type of media/machine-readable medium suitable forstoring electronic instructions (e.g., computer programming code, suchas software or firmware). Moreover, embodiments of the presentdisclosure may also be downloaded as one or more computer programproducts, wherein the program may be transferred from a remote computerto a requesting computer by way of data signals embodied in a carrierwave or other propagation medium via a communication link (e.g., a modemor network connection).

In various embodiments, the article(s) of manufacture (e.g., thecomputer program products) containing the computer programming code maybe used by executing the code directly from the machine-readable storagemedium or by copying the code from the machine-readable storage mediuminto another machine-readable storage medium (e.g., a hard disk, RAM,etc.) or by transmitting the code on a network for remote execution.Various methods described herein may be practiced by combining one ormore machine-readable storage media containing the code according to thepresent disclosure with appropriate standard computer hardware toexecute the code contained therein. An apparatus for practicing variousembodiments of the present disclosure may involve one or more computers(or one or more processors within a single computer) and storage systemscontaining or having network access to computer program(s) coded inaccordance with various methods described herein, and the method stepsof the present disclosure could be accomplished by modules, routines,subroutines, or subparts of a computer program product.

Notably, while embodiments of the present disclosure may be describedusing modular programming terminology, the code implementing variousembodiments of the present disclosure is not so limited. For example,the code may reflect other programming paradigms and/or styles,including, but not limited to object-oriented programming (OOP), agentoriented programming, aspect-oriented programming, attribute-orientedprogramming (@OP), automatic programming, dataflow programming,declarative programming, functional programming, event-drivenprogramming, feature oriented programming, imperative programming,semantic-oriented programming, functional programming, geneticprogramming, logic programming, pattern matching programming and thelike.

TERMINOLOGY

Brief definitions of terms used throughout this application are givenbelow.

The term “client” generally refers to an application, program, processor device in a client/server relationship that requests information orservices from another program, process or device (a server) on anetwork. Importantly, the terms “client” and “server” are relative sincean application may be a client to one application but a server toanother. The term “client” also encompasses software that makes theconnection between a requesting application, program, process or deviceto a server possible, such as a File Transfer Protocol (FTP) client.

The terms “connected” or “coupled” and related terms are used in anoperational sense and are not necessarily limited to a direct connectionor coupling. Thus, for example, two devices may be coupled directly, orvia one or more intermediary media or devices. As another example,devices may be coupled in such a way that information can be passedthere between, while not sharing any physical connection with oneanother. Based on the disclosure provided herein, one of ordinary skillin the art will appreciate a variety of ways in which connection orcoupling exists in accordance with the aforementioned definition.

The phrases “in an embodiment,” “according to one embodiment,” and thelike generally mean the particular feature, structure, or characteristicfollowing the phrase is included in at least one embodiment of thepresent disclosure, and may be included in more than one embodiment ofthe present disclosure. Importantly, such phrases do not necessarilyrefer to the same embodiment.

The term “malicious resource” generally refers to an applicationprogram, process or device that includes a malicious object, such asmalware, web robot or BOT, phishing, modified virus code and/or otherviruses. These malicious objects enable risky activities or policyviolations by the malicious resources. The malware or risky activityincludes, but is not limited to, program and non-program content, suchas computer worms and infected web pages, transmitted to the clientterminals through the network, for example, through public or privateinternet. The policy violation may include, but are not limited to,violation of criteria assigned by the network gateway/administrator.Other examples of risky activities may include bad connection attemptsby the resource, accessing information from restricted sites, such assome foreign sites, adult sites, etc., by the resource.

If the specification states a component or feature “may”, “can”,“could”, or “might” be included or have a characteristic, thatparticular component or feature is not required to be included or havethe characteristic.

The phrase “network gateway” generally refers to an inter-networkingsystem, that joins enables entrance to a network. A “network gateway”can be implemented completely in software, completely in hardware, or asa combination of the two. Depending on the particular implementation,network gateways can operate at any level of the Open SystemsInterconnection (OSI) model from application protocols to low-levelsignaling.

The term “reputation” generally refers to evaluation of a resource basedon consolidated score corresponding to the resource. The reputationindicates behavior of a resource in relation to malware activities.

The term “resource” generally refers to an application, program, processor device that requests information or seeks services of anotherprogram, process or device (a server) in the network.

The term “request” refers to communication message sent from oneresource to another resource.

The term “score” generally refers to the rating given to each resource.The score helps in determining whether the resource is malicious or not.The score indicates compliance of a resource with policies. Each malwareactivity is assigned a base score and this score contributes to theresource's historical or past score whenever the resource undertakes arisky activity. A ‘low score’ is indicative of high malware activity bythe resource or the client and a ‘high score’ is indicative of lowmalware activity by the resource or the client. Alternatively a highscore could indicate increased malware activity depending on the modeladopted, either counting down from an agreed baseline, or counting up toa maximum threshold.

The term “server” generally refers to an application, program, processor device in a client/server relationship that responds to requests forinformation or services by another program, process or device (a server)on a network. The term “server” also encompasses software that makes theact of serving information or providing services possible.

FIG. 1 is a block diagram conceptually illustrating an exemplaryenvironment 100 in which embodiments of the present invention may beemployed. As shown, environment 100 include a network 110 coupled to anumber of resources such as, resources 115-1 to 115-n. Examples ofnetwork 110 can be a computer network such as, but not limited to, aLocal Area Network (LAN), Wide Area Network (WAN), the Internet, aMetropolitan Area Network (MAP), and the like or a mobile network. Itmay be understood that the mobile network may be a Global System forMobile (GSM) network, a Code Division Multiplexing Access (CDMA)network, a Public Switched Telephone Network (PSTN), and the like.Network 110 enables communication between the resources in network 110.A resource 115-1 to 115-n can be a device or an application capable ofperforming various functionalities in network 110. Examples of aresource include, but are not limited to, a server, a personal computer(PC), a printer, a cellular phone, a television, a virtual machine, anoffice work station, and so forth. In an embodiment, a resource may be asoftware entity such as a virtual machine or a virtual server. Inanother embodiment, resource 115-1 to resource 115-n may further beenabled as clients and servers in a client-server environment. In analternate embodiment, resources 115-1 to resource 115-n may be enabledas senders and receivers in a Pub-Sub environment.

Resources 115-1 to 115-n perform various activities such ascommunication over network 110 by exchanging requests, such as, requestsfor file transfer, requests for running an application, requests forestablishing connection and the like. For efficient communication innetwork 110, it is useful that malware activities while exchange of suchrequests is prevented. In order to achieve this, network 110 is coupledto a monitoring unit 105. Monitoring unit 105 facilitates observing ofactivities within network 110. Monitoring unit 105 detects variousrequests exchanged in network 110. Monitoring unit 105 may beimplemented as hardware, software, firmware or a combination of theseand may be located outside of network 110 or within network 110.Examples of monitoring unit 105 include, but are not limited to, anetwork gateway, a network interface card (NIC), a router, an Ethernet,a software module, a hub, a virtual machine, a widget and anapplication.

Monitoring unit 105 may communicatively be coupled to a server (notshown). The server enables processing required by monitoring unit 105and storage of data collected by monitoring unit 105. Apart from theserver, monitoring unit 105 is communicatively coupled to resources115-1 to 115-n. Monitoring unit 105 is configured to detect and analyzethe requests exchanged by resources 115-1 to 115-n. Each requestexchanged among resources 115-1 to 115-n is listened/observed bymonitoring unit 105. Monitoring unit 105 analyses the request from eachof these resources 115-1 to 115-n based on one or more pre-definedpolicies corresponding to resources 115-1 to 115-n. The policies may bebased on geography of the resource initiating the request, the type ofrequest, required application, session event, application event,interaction with various websites, and so forth. These one or morepolicies may be defined by a user (or network administrator), or aresource or network 110 for observing various malware activities.Monitoring unit 105 is configured to associate or provide a score toeach resource coupled to the network based on the policies. Monitoringunit 105 is also configured to store the score related informationcorresponding to each resource in a database at the server. In anexemplary scenario, the database may include score for resources 115-1to 115-n based on the previous request exchanges among resources 115-1to 115-n. Then, the newly associated score may be aggregated with one ormore past scores of the resource. The score can be numeric, alphabets,symbols, or combination of these. Based on the aggregated score for eachresource, a reputation of the resource is identified. The reputation maybe such as, but not limited to, good, bad, safe, harmless, vulnerable,harmful, moderate, and so forth. The reputation indicates whether aresource is malicious or safe. In an exemplary scenario, when reputationof the resource is identified as bad then the resource may be found as amalicious resource. However, if the reputation of the resource isidentified as good, the resource may be considered as a safe resource.Therefore, monitoring unit 105 facilitates classification of devices innetwork 110 based on reputation.

In an embodiment, identification of the reputation may be done manuallyby the user or the network administrator or a programmer. The user mayidentify the reputation for each resource of resources 115-1 to 115-n byreading the score related information or log stored in the database. Inan alternate embodiment, the reputation may be generated automaticallybased on one or more predefined rules specified by the user. The rulesmay be like if the score is less than a threshold value then thereputation for the resource is set as “bad” and otherwise as “good”. Forexample, if the score for a resource 115-1 is “−10”, then resource 115-1is considered to be a bad resource. The user may change the rules or thethreshold value over a period of time. The method of detection ofmalicious resources in the network and various system elements areexplained in detail in the following figures.

FIG. 2 is an exemplary system diagram in accordance with an embodimentof the present invention. As discussed with reference to FIG. 1,resources 115-1 to 115-n may include client and servers in aclient-server environment. A system 200 includes a client 210 capable ofcommunicating with a server 215 by sending and receiving requests. Allthe requests are visible to a monitoring unit 205. While in thissimplified example, only a single client, i.e., client 210, and a singleserver, i.e., server 215, are shown as being monitored by monitoringunit 205, it should be understood that system 200 may include more thanone client and that may interact directly or indirectly with monitoringunit 205 and directly or indirectly with each other. Client 210,monitoring unit 205, and server 215 are connected to each other througha network (not shown), such as an enterprise network or the Internet.Further, the client and the server may be physical or logical devices orone or more applications running on a device in the network. Monitoringunit 205 is capable of actively snooping/sniffing to observe or detectand analyze the requests sent by client 210 to server 215 for malwareactivities. Thus, monitoring unit 205 acts as an active listener. Thestep of observing may include one or more of performing packet-basedinspection of network communications to or from client 210, performingflow-based inspection of the network communications and performing proxybased inspection of the network communications. The packet-basedinspection includes identifying one or more of indications relating toblockage by a firewall associated with the network, indicationsregarding failed Domain Name Server (DNS) resolution and indicationsregarding DNS resolution to undesired sites. Whereas, the flow-basedinspection includes observing client 210 accepting a connection requestfrom a device located outside of the network.

Monitoring unit 205 detects a request from client 210. The request maybe an attempt by client 210 to establish a connection with server 215.Alternately, the request may be a command to execute a function orapplication on server 215. Upon detection of the request, monitoringunit 205 analyzes client 210. Monitoring unit 205 includes one or moremodules for performing the analysis. Monitoring unit 205 includes aresource communication module 220, a policy module 225, and a reputationmodule 230.

Resource communication module 220 is configured to establishcommunication with client 210 for obtaining client-specific information.Client-specific information is typically useful in connection withidentifying behavior of client 210. Examples of client-specificinformation may include, but are not limited to, an Internet Protocol(IP) address, Media Access Control (MAC) address, Device Type or name ofthe end user utilizing client 210. The IP or MAC address is utilized foridentification of client 210. Further, the IP or MAC address may beutilized for identifying additional information, such as geographicallocation of client 210. This client-specific information is also usefulfor logging data corresponding to client 210 for multiple requests madeby client 210 to server 215. The log may be maintained at a databaseassociated with monitoring unit 205. The database may be internal orexternal to monitoring unit 205. In an embodiment, the database may bepresent at another device in the network such as a monitoring server(not shown). Other examples of the client-specific informationcorresponding to client 210 may include a type of network connectionbetween client 210 and server 215, speed of the network connection,Hypertext Transfer Protocol (HTTP) 404 error corresponding to requestmade by client 210, and application corresponding to the request made byclient 210. The information is retrieved by monitoring unit 205 from therequest detected from client 210. Further, the client-specificinformation may be retrieved by establishing communication with client210.

In one embodiment, every piece of client-specific informationcorresponding to client 210 is retrieved by resource communicationmodule 220. In an alternate embodiment, a set or a part of suchclient-specific information may be retrieved corresponding to client210, based on preferences of a user. For example, the user may prefer toobtain information which involves low overhead in retrieval. Forexample, identification of geographical location and type of networkconnection involves low overhead. However, identification of HTTP 404error and application corresponding to the request involves highoverhead. Therefore, the user may prefer to obtain information with lowoverhead.

The information corresponding to client 210 is helpful in obtainingbehavior of client 210. For example, if client 210 is sending continuousrequests for visiting adult websites then this may result in a negativeor a less score for client 210 and thereby a “bad” reputation may beassociated with client 210. Similarly, requests with HTTP 404 error maysignify bad behavior of client 210.

The client-specific information obtained by resource communicationmodule 220 is passed to policy module 225. Policy module 225 includes anumber of policies for analyzing behavior of client 210. The policiesare predefined rules for identifying perceived risky activities. Thepolicies may be defined by the user (e.g., the network administrator)via browser-based interface provided by a network gateway device or viaa command line interface provided by the network gateway device. Thepolicies may also be network or system defined. Alternately, thepolicies may be obtained from predefined standards, for example, basedon Unified Threat Management (UTM) Profiles. For example, the policiesmay include a policy for connection attempts. A request that requiresconnection with a client non-existent over the Internet may result in abad connection attempt. Therefore, a policy may indicate such a scenarioas a perceived risky activity potentially indicative of malware activityby associating such a result with a negative score. Similarly, a policymay define that looking up of Domain Name Server (DNS) name that doesnot exist as a perceived risky activity potentially indicative ofmalware activity. Other examples of policies defining perceived riskyactivities indicative of potential malware activity may include,application events, interactions with hosts in certain geographiclocations, connecting to an IP address that has no route, HTTP 404error, a client with Peer-to-Peer file sharing, session events andinteractions with particular types of sites.

According to one embodiment, the policies are utilized for associating areputation score with client 210. Based on compliance with the policies,on an activity-by-activity basis, the reputation score for client 210may be updated. Therefore, information retrieved by resourcecommunication module 220 is utilized for identifying compliance ofclient 210 with the policies. In an embodiment, the reputation score isdefined as a good score or a bad score based on the compliance with thepolicy. In another embodiment, the score is a numerical value selectedfrom a range of numerical values based on compliance with the policies.For example, a score from a range of 1-100 may be given based on howcompliant the monitored host system is with established policies. Insome embodiments, the score may be a negative numeric value.

In another embodiment, one or more policies are selected from themultiple policies to obtain a profile of client 210. The one or morepolicies may be selected by a user. Alternately, the one or morepolicies may be selected based on a predefined profile. For example,policies included in standard profile for Unified Threat Management(UTM) may be selected. An interface may be provided for selection orde-selection of a policy from the policies. Therefore, the user mayobtain a customized profile of client 210 based on the requiredpolicies. Similarly, the user may adjust scores corresponding to apolicy based on these requirements. For example, consider a scenario inwhich a policy assigns a score of −10 for every 1 MB of data transferredto a client in Russia from a server in United States of America. A useradministrating the policies may realize that a person sending such arequest is a Russian origin residing in the USA. Therefore, the user mayde-select this policy from the profile or the user may reduce the scoreto −1.

The one or more policies selected for defining a profile of client 210are utilized by reputation module 230 to associate a reputation scorewith client 210 based on an aggregate score corresponding to thepolicies included in the profile of client 210. Reputation module 230collects scores associated with each policy in the profile of client210. Further, reputation module 230 may include past and/or historicalscores corresponding to client 210 based on the past requests detectedfrom client 210. The past scores are associated with past requests madeby client 210 to server 215. It should be noted that the historicalscore may be reset on a periodic basis wherein the period isconfigurable by a network administrator. The reputation of client 210 isdetermined based on the consolidated score of client 210. The reputationmay indicate behavior of client 210 for malware activities and atendency for being a malicious resource. In an embodiment, a predefinedlevel of negative or low score may indicate a bad reputation for client210. Similarly, a predefined level of positive or high score mayindicate a good or safe reputation for client 210. Further, if client210 has a score lying between these two predefined levels then client210 may be deemed as neutral meaning that client 210 requires moremonitoring before determining a good or a bad reputation. The predefinedlevels may be defined by the user.

In one embodiment, reputation module 230 may indicate or reportreputation of client 210 in form of bars and charts to a user. Thesereports may be retrieved by the user as per his preference orrequirement or in a periodic manner. Based on the reputation, the usermay identify client 210 as a malicious resource and may take furtheractions. Therefore, a user receives regular updates about behavior ofclient 210 or multiple clients in the network. Further, the user cancustomize various policies and scores corresponding to client 210. As aresult, the reputation obtained for client 210 is based on relevantfactors and obsolete or un-required factors are removed in a timelymanner.

FIG. 3 is another exemplary environment 300 in which various embodimentsof the present invention may function. Environment 300 includes aresource 305 coupled to a network such as Internet 310. Internet 310 maybe further coupled to a local area network (LAN) 335 through a firewall315 and a network gateway 320. In the exemplary environment 300,firewall 315 may represent a hardware or software solution configured toprotect the resources of LAN 335 from outsiders and to control access byenforcing security policies. Firewall 315 may filter or disallowunauthorized or potentially harmful content or requests from enteringLAN 335 and may otherwise limit access between LAN 335 and Internet 310.

In an embodiment, network gateway 320 may act as an interface betweenLAN 335 and Internet 310. Network gateway 320 may, for example,translate between dissimilar protocols used internally and externally toLAN 335. Depending upon the distribution of functionality, networkgateway 320 or firewall 315 may perform network address translation(NAT) to hide private Internet Protocol (IP) addresses used within LAN335. Network gateway 320 or firewall 315 may enable multiple resources,such as resource 340 a, resource 340 b, and resource 340 n, to accessInternet 310 using a single public IP address.

In one embodiment, firewall 315 and network gateway 320 may enablesecure and authorized communication between Internet 310 and LAN 335using a monitoring unit 325. Monitoring unit 325 is coupled to networkgateway 320 to prevent malware activities at LAN 335 from the externalnetwork i.e. Internet 310. Monitoring unit 325 interacts with amonitoring server 330 to enable desired processing. Functionalities andmodules of monitoring unit 325 are explained in detail in conjunctionwith FIG. 1 and FIG. 2.

In an embodiment, monitoring unit 325 may manage requests for all theclients or resources in LAN 335. Therefore, monitoring unit 325 acts asa central entity which observes requests to and/or from all resources340 a to 340 n. Upon detection of any request, monitoring unit 325identifies associated reputation of the client sending the request suchas client 340 a. Monitoring unit 325 may maintain a log of reputation ofall resources 340 a to 340 n that sends requests to external resourcessuch as devices or application which are not part of LAN 335. Monitoringunit 325 may include a database for storing the log or record includingthe reputation and scores of resources 340 a to 340 n or other devicesof environment 300. In addition, monitoring unit 325 may providereputation data corresponding to each client to a database associated tothe client. In an alternate embodiment, each resources 340 a to at LAN335 may maintain a dedicated monitoring unit similar to monitoring unit325. The dedicated monitoring unit may observe requests directed to onlycorresponding client. In another embodiment, monitoring unit 325 mayreside at any device in the Internet or LAN 335. In yet anotherembodiment, monitoring unit 325 may monitor application activity for aclient by activating one or more of application launch control andapplication activity control within the client.

FIG. 4 is an example of a computer system 400 with which embodiments ofthe present disclosure may be utilized. Computer system 400 mayrepresent or form a part of a monitoring unit, a network gateway, afirewall, a network appliance, a switch, a bridge, a router, datastorage devices, a server, a client workstation and/or other networkdevice in a network.

Embodiments of the present disclosure include various steps, which willbe described in more detail below. A variety of these steps may beperformed by hardware components or may be tangibly embodied on acomputer-readable storage medium in the form of machine-executableinstructions, which may be used to cause a general-purpose orspecial-purpose processor programmed with instructions to perform thesesteps. Alternatively, the steps may be performed by a combination ofhardware, software, and/or firmware.

As shown, computer system 400 includes a bus 430, a processor 405,communication port 410, a main memory 415, a removable storage media440, a read only memory 420 and a mass storage 425. A person skilled inthe art will appreciate that computer system 400 may include more thanone processor and communication ports.

Examples of processor 405 include, but are not limited to, an Intel®Itanium® or Itanium 2 processor(s), or AMD®, Opteron® or Athlon MP®processor(s), Motorola® lines of processors, FortiSOC™ system on a chipprocessors or other future processors. Processor 405 may include variousmodules associated with monitoring unit as described in FIG. 2.Processor 405 may include resource communication module 220 forestablishing communication with resources coupled to the network.Processor 405 may further include policy module 225 for includingvarious policies and scoring schemes. In addition, processor 405 mayinclude reputation module 230 for generating reputation of the resourcescoupled to the network.

Communication port 410 can be any of an RS-232 port for use with a modembased dialup connection, a 10/100 Ethernet port, a Gigabit or 10 Gigabitport using copper or fiber, a serial port, a parallel port, or otherexisting or future ports. Communication port 410 may be chosen dependingon a network, such a Local Area Network (LAN), Wide Area Network (WAN),or any network to which computer system 400 connects.

Memory 415 can be Random Access Memory (RAM), or any other dynamicstorage device commonly known in the art. Read only memory 420 can beany static storage device(s) such as, but not limited to, a ProgrammableRead Only Memory (PROM) chips for storing static information such asstart-up or BIOS instructions for processor 405.

Mass storage 425 may be any current or future mass storage solution,which can be used to store information and/or instructions. Exemplarymass storage solutions include, but are not limited to, ParallelAdvanced Technology Attachment (PATA) or Serial Advanced TechnologyAttachment (SATA) hard disk drives or solid-state drives (internal orexternal, e.g., having Universal Serial Bus (USB) and/or Firewireinterfaces), such as those available from Seagate (e.g., the SeagateBarracuda 7200 family) or Hitachi (e.g., the Hitachi Deskstar 7K1000),one or more optical discs, Redundant Array of Independent Disks (RAID)storage, such as an array of disks (e.g., SATA arrays), available fromvarious vendors including Dot Hill Systems Corp., LaCie, NexsanTechnologies, Inc. and Enhance Technology, Inc.

Bus 430 communicatively couples processor(s) 405 with the other memory,storage and communication blocks. Bus 430 can be, such as a PeripheralComponent Interconnect (PCI)/PCI Extended (PCI-X) bus, Small ComputerSystem Interface (SCSI), USB or the like, for connecting expansioncards, drives and other subsystems as well as other buses, such a frontside bus (FSB), which connects processor 405 to system memory.

Optionally, operator and administrative interfaces, such as a display,keyboard, and a cursor control device, may also be coupled to bus 430 tosupport direct operator interaction with computer system 400. Otheroperator and administrative interfaces can be provided through networkconnections connected through communication port 410.

Removable storage media 440 can be any kind of external hard-drives,floppy drives, IOMEGA® Zip Drives, Compact Disc-Read Only Memory(CD-ROM), Compact Disc-Re-Writable (CD-RW), Digital Video Disk-Read OnlyMemory (DVD-ROM).

Components described above are meant only to exemplify variouspossibilities. In no way should the aforementioned exemplary computersystem limit the scope of the present disclosure.

FIG. 5 is a flow diagram illustrating a method for detection ofmalicious resources in accordance with an embodiment of the presentdisclosure. At block 505, a request from a resource such as a clientcoupled to a network is detected by a monitoring unit. The request isdirected for another resource, such as a server coupled to the network.The resources client, server, and monitoring unit have been explained indetail in conjunction with FIG. 1 to FIG. 4. The client and the serverare the resources capable of communicating via requests in the network.The request may relate to establishment of a connection with the serveror concern execution of a command at the server, for example. Based onthe disclosure contained herein, those of ordinary skill in the art willrecognize various other types of requests that may be detected, analyzedand scored.

Upon detection of the request, information corresponding to the clientis received at block 510. In an embodiment, the information may beobtained by establishing communication with the client. For example,communication may be established between the client and the monitoringunit to identify an application corresponding to the request. Similarly,communication may be established to identify whether the client performsPeer-to-Peer file sharing. In an alternate embodiment, the informationmay be obtained by observing one or more details associated with therequest. For example, information such as an IP address, geographicallocation of the client, application and strength of connection betweenthe client and the server may be obtained based on the request or may beotherwise derived based on information associated with the request.

The information corresponding to the client is analyzed corresponding tomultiple policies. The policies are defined to analyze behavior of theclient and to measure the types of number of perceived risky activitiesperformed by the client. Based on the information, compliance of theclient for the multiple policies is observed. Accordingly, a score isassigned to the client at block 515. The score may be obtained byassigning individual scores to each policy of the multiple policies, andthen aggregating the individual scores. Examples of the policies and thescore are explained in detail in conjunction with FIG. 2.

Thereafter, at block 520, the score assigned based on the request isaggregated with a past score (if any) of the client. The past score isan aggregation of the scores assigned to the client for requests made inpast. The past score may correspond to all the requests made in past.Alternately, the past score may correspond to requests made in apre-defined and/or configurable period of time, such as within the lastweek, month, and so forth in the past. The past score is logged in adatabase at the monitoring unit or at any other device or monitoringserver in the network. Further, upon receipt of the request, the pastscore is consolidated with the latest assigned score. Therefore, aconsolidated score for the client is obtained.

The consolidated score is utilized for determining a reputation of theclient at block 525. The reputation indicates behavior of the client inrelation to perceived risky activities associated with potential malwareand a tendency for being a malicious resource. In an embodiment, apredefined level of negative or low score may indicate a bad reputationfor a client. Similarly, a predefined level of positive or high scoremay indicate a good or safe reputation for a client. The level may bedefined by the user or network administrator.

The reputation of the client is utilized by the user to identifymalicious client or resources in the network. At periodic intervals orrandomly, the user may check reputation of various clients in thenetwork. Based on the reputation, the user may report one or moreclients as malicious resources. For example, client having a badreputation or a reputation level below a predefined level may be definedas malicious resources. Therefore, further requests from these maliciousresources may be avoided and any malware activity in the network may beprevented.

FIG. 6 is a flow diagram illustrating a method for customizing policiesand reputation by a user. The user may be a network administrator or aprogrammer who is responsible for administering malware activities in anetwork. The disclosed method enables the user to monitor and customizevarious policies and scoring schemes based on latest activitiesoccurring within/over the network. At block 605, a number of policiesare displayed to the user. The policies are displayed to the user toinform about rules related to various perceived risky activities thatmay be enabled by, initiated by or otherwise associated with a malwareinfection, for example. The policies may be displayed at a displayinterface associated with a monitoring unit. The user may check thepolicies and select appropriate/desired policies for detection ofmalware activities. Selection of the policies may be based on variousfactors. For example, a user may deselect obsolete policies. Further,the user may select policies relevant to a particular geographical area.Selection of the policies may also be based on requirements of thenetwork, and so forth.

The user may select or deselect any policy by utilizing an inputinterface related to the monitoring unit. Further, the user may alsoprovide inputs about scores associated with one or more policies. Theuser may define levels of the scores based on compliance of the one ormore policies. Further, changes are accepted in the policies based onthe inputs received from the user at block 610.

Thereafter, customization of the scores for each policy is done based onthe selected policies, at block 615. Scores associated with eachselected policy are defined. Further, criteria for defining reputationbased on the scores are customized at block 620. The user inputs areutilized for pre-setting required profile for accessing behavior ofclient in the network.

In light of the above method the user may access various settings of aunit involved in monitoring malicious resources, such as the monitoringunit. Manual inputs by the user are advantageous in incorporatingvarious factors which cannot be updated automatically for monitoringmalicious resources. Therefore, efficient customization of themonitoring unit is done.

FIG. 7A-7E illustrate an exemplary graphical user interface (GUI) ofsystem for detecting malicious resources, in accordance with anembodiment of the present disclosure. The GUI includes menus andsub-menus for managing parameters and policies corresponding to networksecurity. Further, the GUI provides various views for demonstratingreports corresponding to malware activities.

At FIG. 7A, an exemplary GUI 700A for configuring client reputationmonitoring/scoring is shown. GUI 700A includes selected policies foraccessing, scoring and otherwise determining a reputation of one or moreclients. Further, filter tabs for removal or addition of more policiesis also included. In addition to tabs for policies, tabs for scorescorresponding to each policy are provided. GUI 700A enables a user tocustomize the policies and scores for assessment of reputation. Via GUI700A, the user is also able to set the policies and scores for a fixedperiod of time. For example, reputation scores may be reset at apredetermined or configurable interval of time, such as every X days(e.g., 1, 5, 7, 10, 14 or 30).

GUI 700A enables a user to manage specific profiles by selecting asettings tab corresponding to the specific profile. For example, a usermay select tab for Anti-Virus settings, resulting in GUI 700Billustrated in FIG. 7B. GUI 700B enables the user to manage settings forAnti-Virus scanning. The user has choice to select and de-select theoptions according to his/her preferences.

At FIG. 7C, an exemplary GUI 700C corresponding to selection ofpre-defined profile is shown. For example, a Unified Threat Management(UTM) profile is selected in GUI 700C. The UTM profile includes varioussub categories such as, ‘Antivirus’, ‘Intrusion Protection’, ‘Webfilter’, ‘Email filter’, and ‘Client reputation.’ Each sub category mayfurther include options which define policies or criteria related tonetwork security. In a scenario, when a user chooses one policy,simultaneous use of another policy may be prohibited.

Once policies and scores associated with reputation of a client havebeen selected and implemented, then logs for monitoring reputation aremaintained. FIG. 7D illustrates screens for demonstrating reportscorresponding to the logs in GUI 700D. Bar charts illustrating aggregatescore of multiple clients are shown. The clients with higher negativescore may be considered as malicious resources. Therefore, a collectiveview of multiple clients in a network may be viewed and assessed.

Any of the clients may be selected to view detailed scoring of theclient. Upon selection a GUI 700E as shown in FIG. 7E may bedemonstrated. GUI 700E shows a bar chart illustrating scorescorresponding to multiple policies. In an embodiment, a log of malwareactivities may be displayed in form of a table along with the bar chart.The user may further view information related to a malware activity suchas, malware activity name and protocol. Therefore, the bar charts ortables give information that indicates how the current reputation scoreof the selected client was derived.

FIGS. 8A-8B illustrate exemplary graphical user interface pages tosupport an alternative configuration method in accordance with anembodiment of the present invention. In the present example, sliders 810a-p may be used to set the level of risk perceived by the user (ornetwork administrator) across a range of threats 811 a-p. Each threat811 a-p is assigned a risk level (e.g., none/off, low, medium, high orcritical) by way of its corresponding slider 810 a-p.

As shown in FIG. 8B, the sliders 810 a-p (via scores assigned to therisk levels 812 a-d) relate directly to the score assigned to a givenclient upon detection of the particular activity/behavior. According tothe settings depicted, when a low risk level activity/behavior isobserved, 5 points are added to the client's reputation score, when amedium risk level activity/behavior is observed, 10 points are added tothe client's reputation score, when a high risk level activity behavioris observed, 30 points are added to the client's reputation score andwhen a critical risk level activity/behavior is observed, 50 points areadded to the client/s reputation score. The network administrator mayedit the point values associated with risk levels as deemed appropriatefor the particular context.

Various embodiments of the present disclosure enable efficient detectionof malicious resources in a network. Behavior of the clients in thenetwork is observed over a period of time based on multiple policies.Therefore, any changes in behavior with time can be instantly recorded.As various policies and scores associated with the policies are adjustedby a user, any adjustment based on change in network configuration maybe accounted. Further, policies going obsolete may be easily removed.Policies may be selected to address targeted attacks in the network aswell. In addition, timely reporting of reputation of clients is providedto the user to manage security threats. The method and system enableautomated observing of malware activities in the network and at the sametime provide manual intervention for controlling the parameters.Therefore, an efficient technique is obtained for detecting of maliciousresources in the network.

While embodiments of the present disclosure have been illustrated anddescribed, it will be clear that the present disclosure is not limitedto these embodiments only. Numerous modifications, changes, variations,substitutions, and equivalents will be apparent to those skilled in theart, without departing from the spirit and scope of the presentdisclosure, as described in the claims.

What is claimed is:
 1. A method comprising: maintaining, by a monitoringunit within a protected private network, a plurality of policies in aform of rules, wherein each policy of the plurality of policies isconfigurable by a network administrator of the protected private networkvia a browser-based interface provided by the monitoring unit andspecifies (i) a perceived risky activity of a plurality of perceivedrisky activities potentially indicative of malware activity and (ii) acorresponding score, wherein the plurality of perceived risky activitiesinclude bad connection attempts, interactions with a hosts in particulargeographic locations external to the protected private network,interactions with undesired websites external to the protected networkand failed Domain Name Server (DNS) resolution requests; observing, bythe monitoring unit, activities relating to a plurality of monitoreddevices within the protected private network; for each observedactivity, assigning, by the monitoring unit, a score to the observedactivity based upon a matching policy of the plurality of polices; foreach of the plurality of monitored devices, maintaining, by themonitoring unit, a current reputation score for the monitored devicebased upon the score and a historical score associated with themonitored device; and classifying, by the monitoring unit, a monitoreddevice of the plurality of monitored devices as potentially being amalicious resource based upon the current reputation score for themonitored device.
 2. The method of claim 1, wherein the monitoring unitis operable within a gateway device.
 3. The method of claim 2, furthercomprising actively snooping, by the monitoring unit, the protectedprivate network for network communications initiated by the plurality ofmonitored devices and network communications directed to the pluralityof monitored devices and storing information associated with the networkcommunications for analysis and scoring.
 4. The method of claim 1,further comprising maintaining, by the monitoring unit, a log of theperceived risky activities.
 5. The method of claim 4, further comprisingresponsive to a drill-down request by a network administrator inrelation to a particular monitored device of the plurality of monitoreddevices, providing, by the monitoring unit, information from the logindicative of how the current reputation score for the particularmonitored device was derived.
 6. The method of claim 1, furthercomprising tracking a geo-location for a network communication initiatedby the monitored device by performing a database lookup for adestination Internet Protocol (IP) address associated with the networkcommunication.
 7. The method of claim 1, further comprising monitoringapplication activity for the monitored device by activating one or moreof application launch control and application activity control withinthe monitored device.
 8. The method of claim 1, wherein said observingincludes one or more of performing packet-based inspection of networkcommunications to or from the monitored device, performing flow-basedinspection of the network communications and performing proxy basedinspection of the network communications.
 9. The method of claim 8,wherein the packet-based inspection includes identifying one or more ofindications relating to blockage by a firewall associated with thenetwork of a packet originated by the monitored device, indicationsregarding failed Domain Name Server (DNS) resolution requests sent bythe monitored device and indications regarding DNS resolution toundesired sites external to the protected private network.
 10. Themethod of claim 8, wherein the flow-based inspection includes observingthe monitored device accepting a connection request from a devicelocated outside of the protected private network.
 11. The method ofclaim 1, further comprising for each of the plurality of monitoreddevices, resetting, by the monitoring unit, the historical score on aperiodic basis.
 12. The method of claim 11, wherein the periodic basisis configurable by the network administrator.
 13. The method of claim 1,further comprising presenting, by the monitoring unit to the networkadministrator, the current reputation scores for the plurality ofmonitored devices.
 14. A network monitoring device for deployment withina protected private network comprising: a processor; a memory havingstored therein one or more routines; and wherein, when executed by theprocessor, the one or more routines perform a method of clientreputation monitoring comprising: maintaining a plurality of policies ina form of rules, wherein each policy of the plurality of policies isconfigurable by a network administrator of the protected private networkvia a browser-based interface provided by the network monitoring deviceand specifies (i) a perceived risky activity of a plurality of perceivedrisky activities potentially indicative of malware activity and (ii) acorresponding score, wherein the plurality of perceived risky activitiesinclude bad connection attempts, interactions with a hosts in particulargeographic locations external to the protected private network,interactions with undesired websites external to the protected networkand failed Domain Name Server (DNS) resolution requests; observingactivities relating to a plurality of monitored devices within theprotected private network; for each observed activity, assigning a scoreto the observed activity based upon a matching policy of the pluralityof polices; for each of the plurality of monitored devices, maintaininga current reputation score for the monitored device based upon the scoreand a historical score associated with the monitored device; andclassifying a monitored device of the plurality of monitored devices aspotentially being a malicious resource based upon the current reputationscore for the monitored device.
 15. The network monitoring device ofclaim 14, wherein the network monitoring device comprises a gatewaydevice.
 16. The network monitoring device of claim 15, wherein themethod further comprises actively snooping the protected private networkfor network communications initiated by the plurality of monitoreddevices and network communications directed to the plurality ofmonitored devices and storing information associated with the networkcommunications for analysis and scoring.
 17. The network monitoringdevice of claim 14, wherein the method further comprises tracking ageo-location for a network communication initiated by the monitoreddevice by performing a database lookup for a destination InternetProtocol (IP) address associated with the network communication.
 18. Thenetwork monitoring device of claim 14, wherein the method furthercomprises monitoring application activity for the monitored device byactivating one or more of application launch control and applicationactivity control within the monitored device.
 19. The network monitoringdevice of claim 14, wherein said observing includes one or more ofperforming packet-based inspection of network communications to or fromthe monitored device, performing flow-based inspection of the networkcommunications and performing proxy based inspection of the networkcommunications.
 20. The network monitoring device of claim 19, whereinthe packet-based inspection includes identifying one or more ofindications relating to blockage by a firewall associated with theprotected private network of a packet originated by the monitoreddevice, indications regarding failed Domain Name Server (DNS) resolutionrequests sent by the monitored device and indications regarding DNSresolution to undesired sites external to the protected private network.21. The network monitoring device of claim 19, wherein the flow-basedinspection includes observing the monitored device accepting aconnection request from a device located outside of the protectedprivate network.
 22. The network monitoring device of claim 14, whereinthe method further comprises for each of the plurality of monitoreddevices, resetting the historical score on a periodic basis.
 23. Thenetwork monitoring device of claim 14, wherein the method furthercomprises presenting to the network administrator the current reputationscores for the plurality of monitored devices.